<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Dear All,</div>
<div> </div>
<div> I am trying to forwarding all cisco IOS and Nexus to remote server</div>
<div>Here is from my syslog-ng.conf</div>
<div> </div>
<div>*********************</div>
<div># Syslog collection for all devices</div>
<div>source s_network {</div>
<div> network(</div>
<div> transport("udp")</div>
<div> port(514)</div>
<div> flags(syslog_protocol)</div>
<div> keep_hostname(yes)</div>
<div> keep_timestamp(yes)</div>
<div> use_dns(no)</div>
<div> use_fqdn(no)</div>
<div> );</div>
<div>};</div>
<div> </div>
<div>destination d_all_logs {</div>
<div> file("/app/syslog-ng/My_custom/My_output/all_devices.log");</div>
<div>};</div>
<div>#All syslogs</div>
<div>log {</div>
<div> source(s_network);</div>
<div> destination(d_all_logs);</div>
<div>};</div>
<div><font face="Times New Roman"> </font></div>
<div>*****************************</div>
<div>#Cisco to elastic Mar.22.2019</div>
<div>destination d_cisco_logs {</div>
<div> file("/app/syslog-ng/My_custom/My_output/cisco.log");</div>
<div> network("10.20.30.44" port(2514) transport(udp) spoof_source(yes));</div>
<div>};</div>
<div>*****************************************</div>
<div>#Cisco logs to elastic Mar.22.2019</div>
<div> </div>
<div>log {</div>
<div> source(s_network);</div>
<div> filter(f_cisco_message);</div>
<div> destination(d_cisco_logs);</div>
<div>};</div>
<div>***********************************</div>
<div>#Cisco to elastic Mar.22.2019</div>
<div>filter f_cisco_message {</div>
<div> match ("Cisco IOS", value ("MESSAGE"));</div>
<div style="text-indent:36pt;">or</div>
<div style="text-indent:36pt;">match ("Cisco Nexus", value ("MESSAGE"));</div>
<div style="text-indent:9pt;"> };</div>
<div style="text-indent:9pt;"><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div>But looks like cisco.log is never have any data inside.</div>
<div>Below is from </div>
<div><font face="Times New Roman"> </font></div>
<div>Could you please review my config and advice ?</div>
<div> </div>
<div>Thank you so much for your reply in advance!</div>
<div> </div>
<div>VL</div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
</span></font>
<P><font style="FONT-SIZE: 9pt">_______________________________________________________________________</font></P>
<P><font style="FONT-SIZE: 9pt">If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference.</font></P>
<P><font style="FONT-SIZE: 9pt">Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future. </font></P>
<P></P></body>
</html>